The data analytics firm has peered into the brains of more than 4 million students across the country. By monitoring every mouse click, every keystroke, every split-second hesitation as children work through digital textbooks, Knewton is able to find out not just what individual kids know, but how they think. It can tell who has trouble focusing on science before lunch — and who will struggle with fractions next Thursday.

Text Size

-

+

reset

Even as Congress moves to rein in the National Security Agency, private-sector data mining has galloped forward — perhaps nowhere faster than in education. Both Republicans and Democrats have embraced the practice. And the Obama administration has encouraged it, even relaxing federal privacy law to allow school districts to share student data more widely.

The goal is to identify potential problems early and to help kids surmount them. But the data revolution has also put heaps of intimate information about school children in the hands of private companies — where it is highly vulnerable to being shared, sold or mined for profit.

A POLITICO examination of hundreds of pages of privacy policies, terms of service and district contracts — as well as interviews with dozens of industry and legal experts — finds gaping holes in the protection of children’s privacy.

The amount of data being collected is staggering. Ed tech companies of all sizes, from basement startups to global conglomerates, have jumped into the game. The most adept are scooping up as many as 10 million unique data points on each child, each day. That’s orders of magnitude more data than Netflix or Facebook or even Google collect on their users.

Students are tracked as they play online games, watch videos, read books, take quizzes and run laps in physical education. The monitoring continues as they work on assignments from home, with companies logging children’s locations, homework schedules, Web browsing habits and, of course, their academic progress.

A report by McKinsey & Co. last year found that expanding the use of data in K-12 schools and colleges could drive at least $300 billion a year in added economic growth in the U.S. by improving instruction and making education more efficient.

Parents, however, are growing increasingly wary — and deeply frustrated. They’re finding that it’s nearly impossible to find out which companies are collecting data on their children, much less how it’s being used.

School administrators are often in the dark, too. They don’t know which digital tools individual teachers are using in the classroom. And when they try to ask pointed questions of the ed tech companies they work with directly, they don’t always get clear answers.

Knewton CEO Jose Ferreira finds such concerns overblown. When parents protest that they don’t want their children data-mined, Ferreira wishes he could ask them why: Is it simply that they don’t want a for-profit company to map their kids’ minds? If not, why not? “They’d rather the NSA have it?” he asked. “What, you trust the government?”

Ferreira said he often hears parents angrily declaring that their children cannot be reduced to data points. “That’s not an argument,” Ferreira said. “I’m not calling your child a bundle of data. I’m just helping her learn.”

LOOPHOLES IN AN OLD LAW

The U.S. Department of Education has called safeguarding children’s privacy a priority. “That has to be first, that has to be foremost, that’s absolutely paramount,” Education Secretary Arne Duncan said in a recent video chat posted by the department.

Companies are supposed to keep standardized test scores, disciplinary history and other official student records confidential — and not use it for their own purposes. But the law did not anticipate the explosion in online learning.

Students shed streams of data about their academic progress, work habits, learning styles and personal interests as they navigate educational websites. All that data has potential commercial value: It could be used to target ads to the kids and their families, or to build profiles on them that might be of interest to employers, military recruiters or college admissions officers.

The law is silent on who owns that data. But Kathleen Styles, the Education Department’s chief privacy officer, acknowledged in an interview that much of it is likely not protected by FERPA — and thus can be commercialized by the companies that hold it.

Districts could write privacy protections into their contracts with ed tech companies. But few do.

A recent national study found that just 7 percent of the contracts between districts and tech companies handling student data barred the companies from selling it for profit.

Few contracts required the companies to delete sensitive data when they were done with it. And just one in four clearly explained why the company needed personal student information in the first place, according to the study, conducted by the Center on Law and Information Policy at Fordham University.

“We don’t know what these companies are doing with our children’s data,” said Joel Reidenberg, the Fordham law professor who conducted the study.

A White House report on big data released earlier this month recognized the risk, and called for updating FERPA. Sen. Ed Markey (D-Mass.) and Sen. Orrin Hatch (R-Utah) on Wednesday began circulating a draft bill to do just that. Their bill would tighten controls on student records and give parents the right to review — and correct — some of the information that private companies hold on their children. But the bill only covers official student educational records, not the streams of “metadata” that companies collect when kids work online.

There’s no conclusive proof any company has exploited either metadata or official student records. But privacy experts say it’s almost impossible to tell. The marketplace in personal data is shadowy and its impact on any one individual can be subtle: Who can say for sure if they’re being bombarded with a certain ad or rebuffed by a particular employer because their personal profile has been mined and sold?

Ed tech insiders will not name bad actors in their industry. But they will say this: It’s quite possible to exploit student data — and there can be a great deal of pressure to do so, especially for startups that are giving away their product for free in hopes of gaining a toe-hold in classrooms.